Unpacking VIDAR using Time-Travel Debugging (TTD) in WinDbg Preview

In the last video, we looked for signs of packing in our malicious sample using IDA Pro. What we found was fairly clear evidence of the use of process hollowing, a common technique of code injection used by malware authors. In this video, I'll introduce Time-Travel Debugging (TTD) in WinDbg Preview. TTD allows you to create a trace of a debug session, then easily step forwards and backwards in the session. This can streamline your debug sessions as you no …

authors code code injection debug debugging hollowing ida ida pro injection malicious malware preview pro process process hollowing session trace travel unpacking vidar video windbg